> He didn't have permission to access the data or test it for flaws.

Yes, he did. He was a student at that university, legitimately using the site in question, who accidentally discovered the flaw whilst entering his own data. (This was clearly stated in the original article.) In other words, he ...

[ more ]